Analysis
-
max time kernel
109s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
30-06-2022 10:00
Static task
static1
Behavioral task
behavioral1
Sample
Re-2181718.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Re-2181718.exe
Resource
win10v2004-20220414-en
General
-
Target
Re-2181718.exe
-
Size
172KB
-
MD5
be2d1ca01da2a323960e94dcae0d4696
-
SHA1
a0a404c6ef2dcb77f65ddf072402eeeecdd1dc2e
-
SHA256
f1ff4fbaa6991440428ea8b228268b6ba82595aa8cdbcf2e7bb8a69835753b31
-
SHA512
883cb35116de50ee923fb5101aa1a6b3dea61897d96a73a51e1bc351dc7181f116dc1e290bf86946300b8998f53e106a064b73e1ebf3f503e1e5e65e2a5ed27c
Malware Config
Extracted
blustealer
Protocol: smtp- Host:
smtp.yandex.ru - Port:
587 - Username:
t.liaen@yandex.com - Password:
@vZe#$#28990
Extracted
asyncrat
0.5.7B
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
127.0.0.1:1111
62.197.136.167:6606
62.197.136.167:7707
62.197.136.167:8808
62.197.136.167:1111
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
-
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
-
Async RAT payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1748-115-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1748-116-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1748-118-0x000000000040C75E-mapping.dmp asyncrat behavioral1/memory/1748-117-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1748-120-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1748-122-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
Processes:
Jcsbrafiyvpxtqostory5m.exepid process 1684 Jcsbrafiyvpxtqostory5m.exe -
Loads dropped DLL 3 IoCs
Processes:
Re-2181718.exeInstallUtil.exepid process 872 Re-2181718.exe 2004 InstallUtil.exe 2004 InstallUtil.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Re-2181718.exeJcsbrafiyvpxtqostory5m.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\Aeigqqh = "\"C:\\Users\\Admin\\AppData\\Roaming\\Tupbtqbro\\Aeigqqh.exe\"" Re-2181718.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\Aeigqqh = "\"C:\\Users\\Admin\\AppData\\Roaming\\Tupbtqbro\\Aeigqqh.exe\"" Jcsbrafiyvpxtqostory5m.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Re-2181718.exeInstallUtil.exeJcsbrafiyvpxtqostory5m.exedescription pid process target process PID 872 set thread context of 2004 872 Re-2181718.exe InstallUtil.exe PID 2004 set thread context of 1616 2004 InstallUtil.exe InstallUtil.exe PID 1684 set thread context of 1748 1684 Jcsbrafiyvpxtqostory5m.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
powershell.exepowershell.exepowershell.exeRe-2181718.exepowershell.exeJcsbrafiyvpxtqostory5m.exepid process 1300 powershell.exe 1748 powershell.exe 1548 powershell.exe 872 Re-2181718.exe 872 Re-2181718.exe 1804 powershell.exe 1684 Jcsbrafiyvpxtqostory5m.exe 1684 Jcsbrafiyvpxtqostory5m.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
powershell.exeRe-2181718.exepowershell.exepowershell.exeJcsbrafiyvpxtqostory5m.exepowershell.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 1300 powershell.exe Token: SeDebugPrivilege 872 Re-2181718.exe Token: SeDebugPrivilege 1748 powershell.exe Token: SeDebugPrivilege 1548 powershell.exe Token: SeDebugPrivilege 1684 Jcsbrafiyvpxtqostory5m.exe Token: SeDebugPrivilege 1804 powershell.exe Token: SeDebugPrivilege 1748 InstallUtil.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
InstallUtil.exepid process 2004 InstallUtil.exe -
Suspicious use of WriteProcessMemory 53 IoCs
Processes:
Re-2181718.exeJcsbrafiyvpxtqostory5m.exeInstallUtil.exedescription pid process target process PID 872 wrote to memory of 1300 872 Re-2181718.exe powershell.exe PID 872 wrote to memory of 1300 872 Re-2181718.exe powershell.exe PID 872 wrote to memory of 1300 872 Re-2181718.exe powershell.exe PID 872 wrote to memory of 1300 872 Re-2181718.exe powershell.exe PID 872 wrote to memory of 1748 872 Re-2181718.exe powershell.exe PID 872 wrote to memory of 1748 872 Re-2181718.exe powershell.exe PID 872 wrote to memory of 1748 872 Re-2181718.exe powershell.exe PID 872 wrote to memory of 1748 872 Re-2181718.exe powershell.exe PID 872 wrote to memory of 1684 872 Re-2181718.exe Jcsbrafiyvpxtqostory5m.exe PID 872 wrote to memory of 1684 872 Re-2181718.exe Jcsbrafiyvpxtqostory5m.exe PID 872 wrote to memory of 1684 872 Re-2181718.exe Jcsbrafiyvpxtqostory5m.exe PID 872 wrote to memory of 1684 872 Re-2181718.exe Jcsbrafiyvpxtqostory5m.exe PID 1684 wrote to memory of 1548 1684 Jcsbrafiyvpxtqostory5m.exe powershell.exe PID 1684 wrote to memory of 1548 1684 Jcsbrafiyvpxtqostory5m.exe powershell.exe PID 1684 wrote to memory of 1548 1684 Jcsbrafiyvpxtqostory5m.exe powershell.exe PID 1684 wrote to memory of 1548 1684 Jcsbrafiyvpxtqostory5m.exe powershell.exe PID 872 wrote to memory of 2004 872 Re-2181718.exe InstallUtil.exe PID 872 wrote to memory of 2004 872 Re-2181718.exe InstallUtil.exe PID 872 wrote to memory of 2004 872 Re-2181718.exe InstallUtil.exe PID 872 wrote to memory of 2004 872 Re-2181718.exe InstallUtil.exe PID 872 wrote to memory of 2004 872 Re-2181718.exe InstallUtil.exe PID 872 wrote to memory of 2004 872 Re-2181718.exe InstallUtil.exe PID 872 wrote to memory of 2004 872 Re-2181718.exe InstallUtil.exe PID 872 wrote to memory of 2004 872 Re-2181718.exe InstallUtil.exe PID 872 wrote to memory of 2004 872 Re-2181718.exe InstallUtil.exe PID 872 wrote to memory of 2004 872 Re-2181718.exe InstallUtil.exe PID 872 wrote to memory of 2004 872 Re-2181718.exe InstallUtil.exe PID 872 wrote to memory of 2004 872 Re-2181718.exe InstallUtil.exe PID 2004 wrote to memory of 1616 2004 InstallUtil.exe InstallUtil.exe PID 2004 wrote to memory of 1616 2004 InstallUtil.exe InstallUtil.exe PID 2004 wrote to memory of 1616 2004 InstallUtil.exe InstallUtil.exe PID 2004 wrote to memory of 1616 2004 InstallUtil.exe InstallUtil.exe PID 2004 wrote to memory of 1616 2004 InstallUtil.exe InstallUtil.exe PID 2004 wrote to memory of 1616 2004 InstallUtil.exe InstallUtil.exe PID 2004 wrote to memory of 1616 2004 InstallUtil.exe InstallUtil.exe PID 2004 wrote to memory of 1616 2004 InstallUtil.exe InstallUtil.exe PID 2004 wrote to memory of 1616 2004 InstallUtil.exe InstallUtil.exe PID 1684 wrote to memory of 1804 1684 Jcsbrafiyvpxtqostory5m.exe powershell.exe PID 1684 wrote to memory of 1804 1684 Jcsbrafiyvpxtqostory5m.exe powershell.exe PID 1684 wrote to memory of 1804 1684 Jcsbrafiyvpxtqostory5m.exe powershell.exe PID 1684 wrote to memory of 1804 1684 Jcsbrafiyvpxtqostory5m.exe powershell.exe PID 1684 wrote to memory of 1748 1684 Jcsbrafiyvpxtqostory5m.exe InstallUtil.exe PID 1684 wrote to memory of 1748 1684 Jcsbrafiyvpxtqostory5m.exe InstallUtil.exe PID 1684 wrote to memory of 1748 1684 Jcsbrafiyvpxtqostory5m.exe InstallUtil.exe PID 1684 wrote to memory of 1748 1684 Jcsbrafiyvpxtqostory5m.exe InstallUtil.exe PID 1684 wrote to memory of 1748 1684 Jcsbrafiyvpxtqostory5m.exe InstallUtil.exe PID 1684 wrote to memory of 1748 1684 Jcsbrafiyvpxtqostory5m.exe InstallUtil.exe PID 1684 wrote to memory of 1748 1684 Jcsbrafiyvpxtqostory5m.exe InstallUtil.exe PID 1684 wrote to memory of 1748 1684 Jcsbrafiyvpxtqostory5m.exe InstallUtil.exe PID 1684 wrote to memory of 1748 1684 Jcsbrafiyvpxtqostory5m.exe InstallUtil.exe PID 1684 wrote to memory of 1748 1684 Jcsbrafiyvpxtqostory5m.exe InstallUtil.exe PID 1684 wrote to memory of 1748 1684 Jcsbrafiyvpxtqostory5m.exe InstallUtil.exe PID 1684 wrote to memory of 1748 1684 Jcsbrafiyvpxtqostory5m.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Re-2181718.exe"C:\Users\Admin\AppData\Local\Temp\Re-2181718.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAxAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Jcsbrafiyvpxtqostory5m.exe"C:\Users\Admin\AppData\Local\Temp\Jcsbrafiyvpxtqostory5m.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAxAA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Jcsbrafiyvpxtqostory5m.exeFilesize
172KB
MD5982f97ccf89f9d50dbc5d152c7139a50
SHA10ba6c448dd8566a1196e642ef1d834d55bf6e3e6
SHA256f41360c7779e6656ec89fdfa40ae58b619d80dd27286802a9e902ab9dde19152
SHA512c51127261b13e135e183c779c2bc10b5f43a2e27ccfd902829abc215beddd2070cf3739ac810201ae4eaf98dc9afab9b5e6923e97b1ca7bd0c7e661706c08fd1
-
C:\Users\Admin\AppData\Local\Temp\Jcsbrafiyvpxtqostory5m.exeFilesize
172KB
MD5982f97ccf89f9d50dbc5d152c7139a50
SHA10ba6c448dd8566a1196e642ef1d834d55bf6e3e6
SHA256f41360c7779e6656ec89fdfa40ae58b619d80dd27286802a9e902ab9dde19152
SHA512c51127261b13e135e183c779c2bc10b5f43a2e27ccfd902829abc215beddd2070cf3739ac810201ae4eaf98dc9afab9b5e6923e97b1ca7bd0c7e661706c08fd1
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD54b8eb146b9cfcc863d7b1b79d2e01054
SHA17719681250173d5713fabe30f35ae202666857f7
SHA25640506a492895d43dcfaf5963caf6a708d9fb2585e1f97ba6345e5e5c23326913
SHA512a0c0f52c87afeae4890b60815175673a2f3988d74f927da7d8c53f948843f65b4cd3592ced06e81edd6f9f53612360525d4a7d21bc65c3d2cb9e2e6e9afc3839
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD54b8eb146b9cfcc863d7b1b79d2e01054
SHA17719681250173d5713fabe30f35ae202666857f7
SHA25640506a492895d43dcfaf5963caf6a708d9fb2585e1f97ba6345e5e5c23326913
SHA512a0c0f52c87afeae4890b60815175673a2f3988d74f927da7d8c53f948843f65b4cd3592ced06e81edd6f9f53612360525d4a7d21bc65c3d2cb9e2e6e9afc3839
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD54b8eb146b9cfcc863d7b1b79d2e01054
SHA17719681250173d5713fabe30f35ae202666857f7
SHA25640506a492895d43dcfaf5963caf6a708d9fb2585e1f97ba6345e5e5c23326913
SHA512a0c0f52c87afeae4890b60815175673a2f3988d74f927da7d8c53f948843f65b4cd3592ced06e81edd6f9f53612360525d4a7d21bc65c3d2cb9e2e6e9afc3839
-
C:\Users\Admin\AppData\Roaming\Tupbtqbro\Aeigqqh.exeFilesize
172KB
MD5b19f61228a003e36f8394f12017b207d
SHA1e9ade60d53088c1c44d5b59555d86ccbe5c53ebf
SHA2565dd7d8653a017ec9241b0e4e993d94d14a16c4b6d98b3f997b6642cb599df235
SHA51294cc2e6413fd5424755aea4d30001bf49f9e63e3171a86ee70b09936b077885b36452266af29c98569f4975e76e5ad888409c5411876c5275251829b52bf30bd
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Users\Admin\AppData\Local\Temp\Jcsbrafiyvpxtqostory5m.exeFilesize
172KB
MD5982f97ccf89f9d50dbc5d152c7139a50
SHA10ba6c448dd8566a1196e642ef1d834d55bf6e3e6
SHA256f41360c7779e6656ec89fdfa40ae58b619d80dd27286802a9e902ab9dde19152
SHA512c51127261b13e135e183c779c2bc10b5f43a2e27ccfd902829abc215beddd2070cf3739ac810201ae4eaf98dc9afab9b5e6923e97b1ca7bd0c7e661706c08fd1
-
\Users\Public\3037384246424646303030333036443242464246463030303330\SQLite3_StdCall.dllFilesize
59KB
MD5d77b227a28a78627c2323cac75948390
SHA1e228c3951f2a9fd0febfe07390633ab4f35727f4
SHA256527ec201dcd7695bd9830eb82ab35a3986121de9ea156193834aed9d79223b82
SHA5125627fbc8bbb98f644e21f101a68f0e0b07b87c264d00ea227286bed8ab6dd4ebf5114f03b632604f775ff93666a409a1a179a81ebfc9246956ba8150ff5b0587
-
\Users\Public\3037384246424646303030333036443242464246463030303330\sqlite3.dllFilesize
585KB
MD55405413fff79b8d9c747aa900f60f082
SHA171caf8907ddd9a3a25d71356bd2ce09bd293bd78
SHA2563e5a28ffde07ac661c26b6ccf94e64c1c90b1f25b3b24c90605aa922b87642eb
SHA5122f09a30fc4da5166bd665210fefa1d44ce344f0ec6a37f127d677aeb3ca4fc0d09b7c9c1540f57da1e3449b7f588a1c61115395e965fa153d4baa5033266ed66
-
memory/872-61-0x0000000004810000-0x000000000485C000-memory.dmpFilesize
304KB
-
memory/872-60-0x0000000008130000-0x000000000825C000-memory.dmpFilesize
1.2MB
-
memory/872-55-0x00000000764C1000-0x00000000764C3000-memory.dmpFilesize
8KB
-
memory/872-54-0x0000000000CC0000-0x0000000000CF0000-memory.dmpFilesize
192KB
-
memory/1300-59-0x000000006F910000-0x000000006FEBB000-memory.dmpFilesize
5.7MB
-
memory/1300-58-0x000000006F910000-0x000000006FEBB000-memory.dmpFilesize
5.7MB
-
memory/1300-56-0x0000000000000000-mapping.dmp
-
memory/1548-73-0x0000000000000000-mapping.dmp
-
memory/1548-77-0x000000006F910000-0x000000006FEBB000-memory.dmpFilesize
5.7MB
-
memory/1548-103-0x000000006F910000-0x000000006FEBB000-memory.dmpFilesize
5.7MB
-
memory/1616-102-0x000000006F910000-0x000000006FEBB000-memory.dmpFilesize
5.7MB
-
memory/1616-91-0x0000000000090000-0x000000000009E000-memory.dmpFilesize
56KB
-
memory/1616-98-0x0000000000090000-0x000000000009E000-memory.dmpFilesize
56KB
-
memory/1616-96-0x0000000000090000-0x000000000009E000-memory.dmpFilesize
56KB
-
memory/1616-94-0x0000000000099C22-mapping.dmp
-
memory/1616-93-0x0000000000090000-0x000000000009E000-memory.dmpFilesize
56KB
-
memory/1684-105-0x0000000004760000-0x0000000004824000-memory.dmpFilesize
784KB
-
memory/1684-71-0x0000000001330000-0x0000000001360000-memory.dmpFilesize
192KB
-
memory/1684-68-0x0000000000000000-mapping.dmp
-
memory/1748-115-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1748-116-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1748-62-0x0000000000000000-mapping.dmp
-
memory/1748-65-0x000000006F910000-0x000000006FEBB000-memory.dmpFilesize
5.7MB
-
memory/1748-120-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1748-117-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1748-118-0x000000000040C75E-mapping.dmp
-
memory/1748-112-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1748-66-0x000000006F910000-0x000000006FEBB000-memory.dmpFilesize
5.7MB
-
memory/1748-113-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1748-122-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1804-106-0x0000000000000000-mapping.dmp
-
memory/1804-110-0x000000006F910000-0x000000006FEBB000-memory.dmpFilesize
5.7MB
-
memory/1804-109-0x000000006F910000-0x000000006FEBB000-memory.dmpFilesize
5.7MB
-
memory/2004-81-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/2004-83-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/2004-90-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/2004-104-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/2004-86-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/2004-84-0x0000000000403528-mapping.dmp
-
memory/2004-78-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/2004-79-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB